upsync

jalim · Aug 26, 2024 · 7f28c55 · 7f28c55
1 parent 9df494d
commit 7f28c55
Show file tree

Hide file tree

Showing 5 changed files with 113 additions and 16 deletions.
diff --git a/kubernetes/main/apps/default/actual/app/helmrelease.yaml b/kubernetes/main/apps/default/actual/app/helmrelease.yaml
@@ -50,22 +50,6 @@ spec:
                 memory: 128M
               limits:
                 memory: 512M
-      up-sync:
-        type: cronjob
-        cronjob:
-          schedule: "@hourly"
-          timeZone: &timeZone Australia/Perth
-          concurrencyPolicy: Forbid
-          successfulJobsHistory: 1
-          failedJobsHistory: 1
-        containers:
-          main:
-            image:
-              repository: ghcr.io/jalim/up_actual_sync
-              tag: v0.0.1@sha256:7d67a8e5b471fd1eae3e0d22aceb297918a241295605371fdc8422396c9088a2
-        pod:
-          restartPolicy: OnFailure
-          securityContext: *securityContext
     service:
       app:
         controller: actual

diff --git a/kubernetes/main/apps/default/actual/ks.yaml b/kubernetes/main/apps/default/actual/ks.yaml
@@ -25,3 +25,24 @@ spec:
     substitute:
       APP: *app
       VOLSYNC_CAPACITY: 5Gi
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app up-sync
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/main/apps/default/actual/sync
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
diff --git a/kubernetes/main/apps/default/actual/sync/helmrelease.yaml b/kubernetes/main/apps/default/actual/sync/helmrelease.yaml
@@ -0,0 +1,57 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: up-sync
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.3.2
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  dependsOn:
+    - name: actual
+      namespace: default
+  values:
+    controllers:
+      up-sync:
+        type: cronjob
+        cronjob:
+          schedule: "@hourly"
+          timeZone: &timeZone Australia/Perth
+          concurrencyPolicy: Forbid
+          successfulJobsHistory: 1
+          failedJobsHistory: 1
+        containers:
+          main:
+            image:
+              repository: ghcr.io/jalim/up_actual_sync
+              tag: v0.0.1@sha256:7d67a8e5b471fd1eae3e0d22aceb297918a241295605371fdc8422396c9088a2
+        pod:
+          restartPolicy: OnFailure
+          securityContext: &securityContext
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+            fsGroupChangePolicy: "OnRootMismatch"
+    persistence:
+      secret-file:
+        type: secret
+        name: up-sync-secret
+        globalMounts:
+          - path: /home/node/app/config.json
+            subPath: config.json
+            readOnly: true
diff --git a/kubernetes/main/apps/default/actual/sync/kustomization.yaml b/kubernetes/main/apps/default/actual/sync/kustomization.yaml
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: default
+resources:
+  - ./helmrelease.yaml
+  - ./upsync.secret.sops.yaml
diff --git a/kubernetes/main/apps/default/actual/sync/upsync.secret.sops.yaml b/kubernetes/main/apps/default/actual/sync/upsync.secret.sops.yaml
@@ -0,0 +1,27 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+    name: up-sync-secret
+stringData:
+    config.json: ENC[AES256_GCM,data:E8gihc5LCDh8WFoJl3XSxRVWkZ1jjxF0BpigvcKNzlRi61cRIaKJ5uju0SN7zXqVlJfG0HxHZ8MvuolZsm19bdrmtt5DNBBldH32aJ4BvNvGmtpY6yTdLXJBjJbKk/dVbaFtAdOQxBPzcd7fLB+cL+q45txT1ntVH75F8HjVDW7pTeFFjoOU8J6H2GI1KdJs5zCCpujKLrzM6qGwFfVYgK3knM/XJMo8VP0Rt6TDWpIDzZEUs18YNozWlvH1ZSc/h1FfH55jgNS7w16vcsYC5lvMS5NiWunBuxahdozJTwCBs7iJU8ebrVLgwbW/AmbQRb/PGI5CDFNrUnX1Wkp2Farcy8hOgVErd7diEI0lpmfOS5FBtAd9WwNSvwpQK1rc9MaulzA4VivWDDDKzMeVzTAyye55K8qMMVkN0dxqEkLGDjntROb67juxO+4xtst+oopl/eFmw56jQd0DCz260rHo8UBQe03kEepU4uRJUHHWk42K0aNshD1kVTDr4DYYepWF1mDQYesPX78bFLN4cvQVpfoGok3VB5tejhPIejPcmEb0G1UDUWzUMNYdTRCXLNReWPYyYuZRduBkz0W4FEK1gQV1A5a/eOEd/9U8VladM9l+8Dot6ZKYdbBhqd3SUJFEexv6YBMoKWdtzsxXvJ0SGnNAwkC0kqC8f/D1LZPMAta0SHQUx/U5hIr4/yLFT7QvSUnKzb7M2AaIjfpuwth7qzUF0C+tE+gVLXEb0cygX8BNM/Y1XINpUhHb7GfIj+9lHxFvHe8GKPcKvMWiiyZQlu11DaqixX7lwtLzDmT1Umk0R4DpGlHHmQYtUxFyiKLhTpYAYmw/+tOqYVPWTBGSVczBsjggSsUoCe6GymVy3Ee+KBbxA4LQ3fKopavZC2Z3DN3VW2+DxBBXOxQrxxb31dSW+Av1QKNuWgRDVHo4871ZPVwBHU7g54ReJ+Rte1mv1rbtw1srnXiK5B3O6hN2lAk3cPjj0hkOSPa/JYVqY09PUW35Lk9u1m1DRQDFo/ENUF8R9iUG0cMXGl++Lo8RefOn/+21UiMXnn8/vxxnapUwjrVxaYIE+ANwGTU5/FItAU1Xu2tNvZvDInlBWmuB2ydSkZDpcudm1JOPf72wewR0hLl8qnMuqJ1jyMNZLpqpiFCHnr2eoMB2Sr4WUtCr7AL3FyUPd0BqVQMV3oTYSOaIn5VgzUKOQviPkO0mk0RGf8yKAIjxjaMgJtV0R2FaE95E1DDlqoWcHbiNTChfioIC2Elq47q1jTGIUN/ZYHTe76pEbCs/aDcF,iv:IKHaXkEwZidYPdCYnCtgD611DqymiTHZd6PcFxs5bBk=,tag:7No05UYBGP15JboBNzrCGA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1zucujcrr89pecplrme76f4vxcc05lg3hm8849mmfggvcvcv4ppls7cquw8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkNWtLdE1VZTA3bThCZmtZ
+            eSsvQTdHYkNCNS9Yd3lQK2hRTTJhS25Fc1RJCmE0cnZaL1hQYlI2VUNNTlIrVFA1
+            Z3lDSG5vbzYvL2VVY1dEam4rNWovMk0KLS0tIE4xbERlNWRZN3lIUjlhVExVK1dJ
+            QnQ5TG5kRUJNRldaclFpZ1k4M0xUM0kKUC2Z3HGY9ylNVYPI+Hs+IIAnPyToQzaY
+            4r4R+gcfIzSn9cQIbySas1LCMUMegM5+ecEu3XP4RDfsnKfefqWeCA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-08-26T15:11:01Z"
+    mac: ENC[AES256_GCM,data:etRRj8pNtt6Br1xRN9mRwKLbF9mXwEaO1QPNt4CKVMKzyrbk+rH3Eb0vx93ZqYHZQhwnRrJEXK2LQcZAzLb0EUIDv4b5AnQbwTIf+tyNFWF18Xtop1Skmt3XdgXAcf3GS7bq+lXXTUnvBL+WOnTWlEO9zlhLL/f3tB4vWdCA7Ns=,iv:0Ehr/DpvJvbkghwUFLfogSuLV55yMCd4ZiGDbgdcoQU=,tag:84qhHHHT1Vj0+xUmx1+MTA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1